netspi / moneyx

MoneyX is an intentionally vulnerable JSP application used for training developers in application security concepts.

 ,-----.,--.                  ,--. ,---.   ,--.,------.  ,------.
'  .--./|  | ,---. ,--.,--. ,-|  || o   \  |  ||  .-.  \ |  .---'
|  |    |  || .-. ||  ||  |' .-. |`..'  |  |  ||  |  \  :|  `--, 
'  '--'\|  |' '-' ''  ''  '\ `-' | .'  /   |  ||  '--'  /|  `---.
 `-----'`--' `---'  `----'  `---'  `--'    `--'`-------' `------'
----------------------------------------------------------------- 

     __     ___     _                 
  _ _\ \   / (_)___(_)_   _ _ __ ___  
 | '_ \ \ / /| / __| | | | | '_ ` _ \ 
 | | | \ V / | \__ \ | |_| | | | | | |
 |_| |_|\_/  |_|___/_|\__,_|_| |_| |_|
---------------------------------------
https://nvisium.com

MoneyX - an intentionally vulnerable payment application

Quick Start (Cloud9)

• Run gradle --console plain build run - Watch for the following banner to print out from the gradle process

:run

  .   ____          _            __ _ _
 /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
 \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
  '  |____| .__|_| |_|_| |_\__, | / / / /
 =========|_|==============|___/=/_/_/_/
 :: Spring Boot ::        (v1.2.4.RELEASE)

• Login as username user and password user123

Preview the app

1. Once started, a popup will appear in the terminal window with the URL.
2. Click the URL from the popup to open a new tab.
3. Login as username user and password user123

Relaunching the app

1. Ctrl+C to kill the process
2. gradle --console plain build run
3. Login as username user and password user123

moneyx's Issues

Update session management vuln based on course

Add issues related to session token security

A problem occurred evaluating root project 'MoneyX'.

When trying to run: gradle --console plain build run, here what I get:

➜  MoneyX git:(master) ✗ gradle --version

------------------------------------------------------------
Gradle 5.1
------------------------------------------------------------

Build time:   2019-01-02 18:57:47 UTC
Revision:     d09c2e354576ac41078c322815cc6db2b66d976e

Kotlin DSL:   1.1.0
Kotlin:       1.3.11
Groovy:       2.5.4
Ant:          Apache Ant(TM) version 1.9.13 compiled on July 10 2018
JVM:          1.8.0_191 (Oracle Corporation 25.191-b12)
OS:           Mac OS X 10.14.2 x86_64

➜  MoneyX git:(master) ✗ gradle --console plain build run

FAILURE: Build failed with an exception.

* Where:
Build file '/Users/freddyboucher/Programming/MoneyX/build.gradle' line: 21

* What went wrong:
A problem occurred evaluating root project 'MoneyX'.
> Failed to apply plugin [id 'io.spring.dependency-management']
   > Could not create task ':dependencyManagement'.
      > Could not create task of type 'DependencyManagementReportTask'.
         > Unable to determine io.spring.gradle.dependencymanagement.report.DependencyManagementReportTask_Decorated argument #1: missing parameter value of type interface org.gradle.logging.StyledTextOutputFactory, or no service of type interface org.gradle.logging.StyledTextOutputFactory

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.

* Get more help at https://help.gradle.org

BUILD FAILED in 0s

Seed data for everything.

Need to populate events, payments, friend requests, etc. Can't have any parts of the app appear to be empty at load.

Balance Update

Balance amount does not update until a complete reload of the application. Enable instant updates.

Add a license file

Could you please clarify under which license this code can be used/distributed?

Link to Source in Vuln

Add a link to the source in the Description section of each vuln.

Profile Page doesn't exist

404 not found.

EventMembership Name

Be able to pull the names of events with calling eventService.getEventsByMembership(user). Can't currently access this values.

Login Page beautification

Currently doesn't tell you anything about the service, etc. Add Forgot Password and Register links.

Event Cleanup

It isn't clear what events are used for. Include some verbiage to help determine what need this solves.

findEventMemberShipByUserId should also return user's that OWN an event

@query("select e from EventMembership e where e.user = ?1")
public List findEventMembershipByUserId(Long userId);

Link to vulnerable app in problem section

Redirect Vulnerability Not Working

The redirect vulnerability isn't working as described. Logic is preventing the register function from ever getting to the "next" parameter, meaning the app is not vulnerable to insecure redirect.

Forgot Password functionality

yup yup, needs to be created.

Password Writeup

Need a vuln writeup of password issues with MoneyX

Dashboard

The dashboard should instruct the user how to use the application or at least give some hints. Maybe include a couple of buttons for commonly used functions (Make a Payment, Add a friend, etc).

DOM XSS

Doesn't exist anywhere. We need some javascript function built into a page that is vulnerable. Writeup as well.

Friends need names

All of the friend functionality does not include user name lookups, so we are stuck with IDs on each page. Perform user name lookups on each friend page to fill out the UI.

XSS split

Split out XSS into three sections.

Command/Code Injection Writeup

Writeup for Command/Code Injection needs to be created in vulns.

Make a payment

Currently broken. There is no way to make a payment in the application. This is core functionality that needs to be flushed out. Drop it straight on the Dashboard, perhaps?

Broken Authentication Vulnerability

Need vulnerability and documentation writeup for broken auth.